The system
Records locked on your hardware
Every record is encrypted on your own machines, with an encrypted backup you keep off site. Only you hold the keys, so no outside company can read any of it.
Encrypted at rest · keys held by the tribe
- Runs on
- Your own hardware
- Connection
- Works offline, air-gap capable
- Proof
- Every record sealed and checkable
- Control
- Your keys, your roles, your code
The records live on computers you control, locked so that nobody who finds the drive can read a thing.
A locked backup goes to a drive you keep somewhere safe. If a machine ever fails, you restore onto another one and are running again in minutes.
The records answer to you alone, on hardware you hold and keys you control. They are yours, in your hands.
The three places a record can be exposed
Records get lost in three ways: the machine holding them is taken, the copy of them is intercepted while moving, or someone who should not read them is given a way in. Each one is closed differently, and a system that closes only one of them has not closed anything.
| Where the risk is | What closes it |
|---|---|
| The machine, at rest A computer or a backup drive walks out the door | Storage is locked on hardware you control, and the backup is an encrypted copy that reads as nothing without your keys |
| The record, in motion Records moving between offices, machines, or an off-site copy | Encrypted before it leaves, using a scheme built to resist both today's computers and tomorrow's, and readable only by the offices you have granted |
| The way in A person or a program reaching for a record | Access follows the job, sensitive actions need a sign-off, and a record outside your scope does not appear at all |
The protection is matched to the exposure. Anything leaving your building is encrypted before it goes, with the keys held by you.
Where the records live, from each seat
Tribal IT
You hold the keys, and you can rotate them.
Keys belong to the tribe, not to a vendor console. When a key has to change, the keys are re-wrapped without touching the records themselves, so rotation is a routine action and not a migration project.
Council
There is no outside party in the data.
No company holds a copy, so no company can be compelled, breached, or sold in a way that reaches your records. What you cannot hand over, nobody can take.
Staff
A lost laptop is not a disaster.
The machine in front of you holds the work. If it is lost or fails, the encrypted backup restores onto another one and the office is running again, with the history intact.
Backups you actually control
A backup held in an outside company's account is another copy of your records in somebody else's building. A backup you hold is an encrypted drive in a safe place that only your keys can open.
Recovery is quick because the backup carries the complete sealed history, not just the current state of the files. You restore onto another machine and the record is whole, provable, and continuous, including everything that happened before the failure.
- The backup is written encryptedIt is sealed before it leaves the machine, so the drive is safe to store off site. Whoever finds it holds unreadable data.
- You keep it where you decideA drive in a safe, a second building, or wherever your government's own policy says records belong. There is no account with an outside company.
- Restoring is a normal TuesdayPoint a new machine at the backup, unlock it with your keys, and the office is working again with the whole history in place.
- The same format grows with youThe sealed archive that backs up one office is how a single-office deployment later moves onto a shared server. The first step is never thrown away.
When a record has to be erased
Governments sometimes have to remove personal information while still proving that the removal itself was proper and authorized. Those two obligations look like they conflict, and in most systems they do.
The way through is to seal a receipt for the erasure that names no personal information, then remove the underlying record. The person's information is gone. The proof that it was removed, by whom, and when, remains, and it stands up to an audit without reintroducing what was supposed to be deleted.
Questions tribes ask about storage
- Who else has a copy of our records?
- Nobody, unless you make one. The records sit on your hardware, and the backup is a drive you hold. There is no vendor-side copy to request, subpoena, or breach.
- What happens if a key is lost or a person leaves?
- Access is granted, narrowed, and revoked as a normal action, and keys can be rotated without touching the records themselves. A departing employee's access ends without a rebuild.
- Can we take everything with us?
- Yes, at any time, in a format you can open, with the sealed history intact. The records are files on hardware you own, which is what makes exporting them unremarkable.